Something connecting to a webpage every minute - Page 2
Page 2 of 2 FirstFirst 12
Results 11 to 14 of 14

Thread: Something connecting to a webpage every minute

  1. #11
    Junior Member
    Join Date
    Aug 2006
    Posts
    15
    I'll do a scan and post what I find

  2. #12
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,403
    Perhaps you should concentrate on the machine that's causing the requests instead of trying to find out what the login.fric.cn host is?

    As phish already pointed out.. It's probably linked to Cool Web Search.. Now go and clean that machine

    The (default) page does indeed show a form:

    Code:
    dice@maelcum:~>nslookup login.fric.cn
    Server:         2001:xxxx:yyyy:1::2
    Address:        2001:xxxx:yyyy:1::2#53
    
    Non-authoritative answer:
    Name:   login.fric.cn
    Address: 64.71.167.64
    
    dice@maelcum:~>nc 64.71.167.64 80
    GET / HTTP/1.1
    Host: login.fric.cn
    
    HTTP/1.1 200 OK
    Content-Length: 95
    Content-Type: text/html
    Server: ********.embedded/0.9
    
    <FORM ACTION="http://www.microsoft.com" METHOD=POST>
    <input type=submit value=" Go! ">
    </FORM>
    It's probably a stub. If you really want to know what it does take a closer look at the requests the infected machine is sending.. Fire up your favorite sniffer and capture that traffic..

    Whois on the IP shows it's owned by Hurricane Electric Internet Services.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  3. #13
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,324
    Sirdice:
    Thanks for that. I can get to that address, but can't resolve via dns.
    Oh well, doesn't really matter anyway.
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  4. #14
    Junior Member
    Join Date
    Aug 2006
    Posts
    15
    Yes, I've seen that it looks at that webpage everytime i connect to some webpage with IE, so its probably coolwebsearch or something simmilar, however, i'm curious about what it actually sends so I'll keep for some time to find out hehehe.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides